Hermes WebUI allows an attacker who has already authenticated to delete arbitrary files on the host system. The flaw resides in the /api/session/delete endpoint where the session_id parameter is not validated for path correctness, enabling absolute or traversal paths to be supplied. This permits removal of writable JSON files located outside the intended session directory, potentially destroying configuration data or other critical files. The vulnerability is a classic absolute path traversal (CWE-22) and results in loss of data integrity and availability.

The affected product is Hermes WebUI from nesquena. No specific version information is provided in the advisory, but the patch on GitHub and the release notes for tags v0.50.132 and v0.50.32 suggest that these releases contain the fix.

The CVSS score of 7.2 places the issue in the high‑severity range, and while an EPSS score is not available, the lack of a KEV listing indicates no widespread, known exploitation. A successful exploit requires authenticated access to the API, so the attack is limited to users who can log in to the WebUI. Once authenticated, an attacker can craft a session_id that points to any writable file on the host, leading to file deletion. The risk remains significant for organizations that rely on Hermes WebUI for configuration or data storage.